Unfavorable aircraft-pilot coupling (APC) events are rare, unexpected, and unintended excursions in aircraft attitude and flight path caused by anomalous interactions between the aircraft and the pilot. The temporal pattern of these pilot-vehicle system (PVS) excursions can be oscillatory or divergent (non-oscillatory). The pilot's interactions with the aircraft can form either a closed-loop or open-loop system, depending on whether or not the pilot's responses are tightly coupled to the aircraft response. When the dynamics of the aircraft (including the flight control system [FCS]) and the dynamics of the pilot combine to produce an unstable PVS, the result is called an APC event.
Although it is often difficult to pinpoint the cause of specific APC events, a majority of severe APC events result from deficiencies in the design of the aircraft (especially with regard to the FCS) that result in adverse coupling of the pilot with the aircraft. In certain circumstances, this adverse coupling produces unintended oscillations or divergences when the pilot attempts to precisely maneuver the aircraft. If the PVS instability takes the form of an oscillation, the APC event is called a ''pilot-involved oscillation" (PIO). PIOs differ from aircraft oscillations caused by deliberate, pilot-imposed periodic control motions, such as "stick-pumping," that are open-loop in character. An open-loop, forced oscillation does not constitute a PIO. If the unstable motions of the closed-loop PVS are divergent rather than oscillatory in nature, they are referred to as either APC events or as non-oscillatory APC events.
APC events can result if the pilot is operating with a behavioral mode that is inappropriate for the task at hand, and such events are properly ascribed to pilot error. However, the committee believes that most severe APC events attributed to pilot error are the result of adverse APC that misleads the pilot
into taking actions that contribute to the severity of the event. It is often possible, after the fact, to carefully analyze an event and identify a sequence of actions that the pilot could have taken to overcome the aircraft design deficiencies. However, it is typically not feasible for the pilot to identify and execute the required actions in real time.
PIO phenomena comprise a complete spectrum. At one end of the spectrum is a momentary, easily corrected, low-amplitude bobble, a type of oscillation often encountered by pilots getting used to new configurations—basically a learning experience. This type of oscillation can happen on any aircraft and has been experienced by most pilots at one time or another. At the other end of the spectrum is a fully-developed, large amplitude PIO, a chilling and terrifying event that jeopardizes the safety of the aircraft, crew, and passengers. Fortunately, severe PIOs are rare.
Other severe APC events have been noted in which the excursions in aircraft motion diverge over time rather than oscillate. The few events of this nature that have been positively identified have had serious consequences. Large amplitude, dangerous PIOs and non-oscillatory APC events are the particular concerns of this report.
Recently, there have been several highly visible APC-related accidents involving military aircraft, as well as a number of incidents involving civil aircraft. At the same time, there has been widespread introduction of new fly-by-wire (FBW) FCSs into commercial transports. Almost all new FBW-equipped aircraft have exhibited APC events at some time during development, and these untoward coincidences have captured the attention of policymakers, test pilots, technical managers, and engineers. Although FBW systems are not inherently more or less susceptible to severe APC events, the flurry of incidents in aircraft development programs suggests that some side effects have not been fully explored or anticipated. Thus, as a matter of prudence the National Aeronautics and Space Administration asked the Aeronautics and Space Engineering Board of the National Research Council to conduct a study to assess APC-related aspects of recent incidents and accidents, aircraft development processes, the introduction of FBW and fly-by-light technology into FCSs, and national and international efforts devoted to APC research. This report is the result of that study, and it recommends steps that could be taken to improve aviation safety by reducing the kinds of APC problems seen recently and countering new types of APC problems that may arise.
The following high-level conclusions of the study committee are worth highlighting. (Subsequent sections include the committee's key findings and recommendations, and all findings and recommendations are listed in Chapter 7.)
- There are many varieties of oscillatory and non-oscillatory APC events. Although none of these is welcome, only a rare subset is dangerous. Among the dangerous ones are events that exhibit "cliff-like"
- characteristics, which means that a PVS may fly superbly up to the sudden onset of a dramatic and potentially catastrophic APC event. What these severe APCs are, when they are likely to occur, and how to find (and fix) them are key issues.
- Most of the severe PIOs for which flight recordings exist have exhibited oscillations characterized by rate limited responses in control surface actuators or effectors. (Control surface actuators and effectors are rate or position limited when commanded movement exceeds limits imposed by design intent or physical structure on the rate of movement or extreme position of the control surface.) In most cases the pilots indicated that the onset of the PIO was sudden, unexpected, and cliff-like.
- Piloted simulations have proved to be useful for investigating APC tendencies. However, neither piloted simulations nor available design and testing criteria can guarantee that a new aircraft will not be involved in an APC event.
- Severe APC events are invariably new "discoveries" that often occur in transient and highly unusual circumstances. To avoid their discovery by operational pilots under unfavorable circumstances, test pilots must be allowed some freedom to search for APC tendencies in simulations and flight tests.
- Data on recent APC events indicate that they are not uncommon in development testing where data recording and pilot reports are sufficient for causes to be determined and solutions developed. There are only a few reports of severe APC events in operational aircraft, but because there are no mandatory reporting requirements and recordings are often inadequate, the danger cannot be assessed adequately.
- The committee was disturbed by the lack of awareness of severe APC events among pilots, engineers, regulatory authorities, and accident investigators.
The Aircraft-Pilot Coupling Experience
APC events usually occur when the pilot is engaged in a highly demanding, closed-loop control task. For example, many of the reported APC events have taken place during air-to-air refueling operations or approaches and landings, especially if the pilot is concerned about low fuel, adverse weather, emergencies, or other circumstances. Under these conditions, the pilot's involvement in closed-loop control is intense, and rapid response and precise performance of the PVS are necessary. Even so, these operations usually occur routinely without APC problems. APC events do not occur unless there is a transient triggering event that interrupts the already highly-demanding
PVS operations or requires an even higher level of precision. Typical triggers include shifts in the dynamics of the effective aircraft (the combination of the aircraft and FCS) caused by increases in the amplitude of pilot commands, FCS changes, minor mechanical malfunctions, or severe atmospheric disturbances. Other triggers can stem from mismatches between the pilot's expectations and reality.
PIOs have been part of aviation history since the beginning of manned flight, and severe PIOs persist in spite of major efforts to eliminate them. When one kind of PIO occurs, usually unexpectedly, it stirs corrective actions. The experience is generally useful, in that the conditions thought to underlie that type of PIO tend to be avoided in designing new aircraft. As other PIOs occur under different circumstances, the cycle is repeated. With time, understanding improves and some causes are circumvented, but the occurrence of closed-loop oscillations remains a constant; only the details change with the aircraft and FCS technology.
From the pilot's perspective, there are three varieties of PIO experiences, ranging from benign learning experiences to severe and potentially dangerous oscillations. The benign "bobbles" are easily countered by the pilot's exit from the closed-loop PVS. By contrast, in many severe PIOs the pilot becomes locked into behavior that sustains the oscillation, even though the pilot often feels totally disconnected from the system. If the deficiencies in effective aircraft dynamics are essentially linear in nature, such as excessive time lag in response to a pilot input, a Category I PIO may result. If the effective aircraft dynamics change as a function of pilot-command amplitude or of FCS mode shifts, thereby creating a nonlinear sudden-onset change (a "cliff") in the effective aircraft dynamics, the resulting PIO is assigned either to Category II (when the dominant nonlinearities are associated with rate or position limiting of the control surfaces) or Category III (when the nonlinear changes are more complex). The Category II and III PIOs are particularly insidious because the effective aircraft dynamics and the associated flying qualities can be good right up to the instant the PIO begins. Identifying the potential for these PIOs, which almost always occur under unusual conditions when the PVS is operating near the margins, is a major challenge to test pilots and engineers. An extensive search process with a ''discovery" mentality is needed to ensure that Category II or III tendencies are not overlooked.
Non-oscillatory APC events are not as well defined or understood as PIOs. Even if the pilot is extremely active and initiates many control reversals, the aircraft does not necessarily respond in an oscillatory fashion. Instead, a buildup of lags in the response of the aircraft's control effectors to the pilot's commands may ultimately lead to a divergence from the intended aircraft movement. As in the case of severe PIOs, pilots in these cases often report a sense of feeling detached from the aircraft behavior in terms of both awareness of what is happening and in terms of the temporal connections between pilot command and aircraft response.
Finding. Adverse APC events are rare, unintended, and unexpected oscillations or divergences of the pilot-aircraft system. APC events are fundamentally interactive and occur during highly demanding tasks when environmental, pilot, or aircraft dynamic changes create or trigger mismatches between actual and expected aircraft responses.
Impact Of New Technology
As phenomena in aviation history, APC problems have often been associated with the introduction of new technologies, functionalities, or complexities. There is a time lapse before flight experience with a new technology reveals the subtle changes in effective aircraft dynamics that may increase the susceptibility of a new aircraft to APC events. This partly explains why APC problems are more prevalent in military aircraft, which have traditionally introduced advanced technologies, and less common in civil aircraft, which have tended to adopt new technologies only after they have been proven in military aircraft. The prevalence of APC problems in military rather than commercial aircraft may also be associated with the nature of military operations, which frequently include maneuvers that require higher pilot gains than are commonly used on commercial aircraft.
FBW technology, which for this report includes fly-by-light technology, is a recent example of a new technology that has migrated from military to civil aircraft. The application of FBW technology has created FCSs that confer important overall system advantages in terms of performance, weight reduction, stability and control, operational flexibility, and maintenance requirements. FBW also offers opportunities for novel approaches to solving all kinds of problems with aircraft stability and control (including correcting APC tendencies). Yet, the flexibility inherent in FBW technology has the potential for creating unwanted new side effects and unanticipated problems.
In an aircraft equipped with a FBW FCS, information is transmitted from the cockpit to the control surfaces entirely by electrical means. The cockpit control device may not indicate to the pilot when the control surfaces are rate or position limited. The result may be a mismatch between the pilot's expectations and the aircraft's actual response, which can directly contribute to an APC event. In addition, FBW technology allows aircraft designers to design an FCS that features an elaborate set of system modes intended to enhance aircraft performance for a variety of missions under all expected flight conditions. When properly implemented, shifts between these system modes are smooth and unobtrusive and do not interfere with the pilot's operation of the aircraft. However, the complexity inherent in an advanced multiredundant FBW FCS makes it difficult for the designers, much less the pilots, to anticipate all of the possible interactions between the FCS and the pilot. The
FCS may operate in ways that the pilot does not expect and does not recognize, thereby increasing the potential of encountering an APC event. As the potential for untoward events expands with the introduction of new technologies, increased vigilance is necessary to ensure that new systems do not inadvertently increase the susceptibility of new aircraft to APC events.
Finding. APC problems are often associated with the introduction of new designs, technologies, functions, or complexities. New technologies, such as FBW and fly-by-light flight control systems, are constantly being incorporated into aircraft. As a result, opportunities for APC are likely to persist or even increase, and greater vigilance is necessary to ensure that new technologies do not inadvertently increase the susceptibility of new aircraft to APC events.
Aircraft-Pilot Coupling Events As A Current Problem In Aviation
A major task of the committee was to assess the current status of APC events as a safety problem in aviation. In the context of aircraft development and testing, the record clearly shows that although adverse APC events are rare, they can pose a major safety concern. The same record also provides an extraordinary set of recent examples that should alert project and engineering managers, design engineers, test pilots, and aircraft operators to the need to address concerns about APC events as a central flying qualities and safety issue. These concerns can be addressed through detailed test plans, elaborate flight-test data recorders, and highly trained pilots like the ones who participate in the developmental stages of new aviation technology. Addressing these concerns will ensure that APC events that occur during development become matters of record.
When an aircraft enters operational service, the elaborate flight data recorders are routinely removed. The flight data recorders that are installed on many commercial aircraft employ a limited number of channels and sample rates; many military aircraft have no flight data recorders at all. For these and other reasons, confirmed APC-related incidents or accidents on operational FBW aircraft are quite rare.
The occurrence of PIOs or other APC events at some point in the development of almost all FBW aircraft, contrasted with the almost total absence of APC events reported in operational stages, is viewed by the committee as a "curious disconnect." The hope is that all major APC tendencies have been discovered and corrected in the course of development, but because of the limited recording and reporting procedures in operations, this cannot be confirmed. Consequently, the committee was not able to assess fully the exposure of operational fleets to APC events.
Finding. APC problems have occurred more often in military and experimental aircraft, which have traditionally introduced advanced technologies, than in civil aircraft.
Finding. Recently, civil and military transport FBW aircraft have experienced APC problems during development and testing, and some APC events have occurred in recent commercial aircraft service, although they may not always have been recognized as such.
The committee has observed that APC events are perceived by the majority of the aviation community as exotic happenings that are occasionally documented by spectacular video footage shown on the evening news but are not of major concern. This complacent attitude is reinforced by a lack of awareness, understanding, and relevant experience. This shortcoming should be addressed through improved education and training of personnel involved in aircraft design, simulation, testing, certification, operations, and accident investigation.
A dramatic way to enhance awareness is to expose flight test pilots and engineers to actual APC events in flight and thereby indelibly imprint on them the insidious character and the danger of such phenomena. Although this could be done at relatively little expense using existing variable stability aircraft, this kind of training for test pilots and engineers is not common in industry, the Federal Aviation Administration, or the Department of Defense. (It may also be possible to use ground-based simulators for APC awareness training, especially for Category I APC events, but they are not likely to make the same sort of dramatic impression on pilots as in-flight experiences.) The committee believes test pilots need specialized training to improve their ability to detect adverse APC characteristics. Test pilots tend to adapt very quickly to new aircraft, and they may unconsciously compensate for deficiencies in a FCS that, in some circumstances, could contribute to an APC event. Therefore, their training should also include aggressive searches for tendencies that could lead to APC events.
Because most line pilots have not been trained to recognize and report adverse APC characteristics, they often attribute PIOs to deficiencies in their flying skills. The committee suspects that this tends to limit reporting of adverse APC events to safety reporting systems.
Appropriate training is equally important for accident investigators and others involved in evaluating flight operations. Investigators should be knowledgeable about APC hazards and how to identify them. The improving capabilities of flight data recording systems will aid investigators in
determining whether APC phenomena contributed to specific incidents and accidents.
Recommendation. Insufficient attention to APC phenomena generally seems to be associated with a lack of understanding and relevant experience; this shortcoming should be addressed through improved education about APC phenomena for pilots and other personnel involved in aircraft design, simulation, testing, certification, operation, and accident investigation.
Eliminating Aircraft-Pilot Coupling Events
To increase the likelihood of finding major APC tendencies during the development process, the committee recommends that a disciplined and structured approach be taken in the design, development, testing, and certification of aircraft. This approach is intended to improve existing techniques for mitigating the risk of adverse APC and to expedite the adoption of new techniques as they become available.
The elimination of APC events requires both an effective technical approach and a highly supportive management structure. In the past, a possible susceptibility to APC was sometimes detected during simulations and analysis early in the development of new aircraft but was dismissed by managers or designers as premature or irrelevant because the susceptibility was associated with tasks that were viewed as uncharacteristic of actual flight operations. In other cases, APC susceptibility has been inadvertently introduced into new aircraft with design changes that were not fully assessed for their impact on APC characteristics. Program managers and designers should implement a highly structured systems-engineering approach that involves all relevant disciplines in the APC-elimination process from early in the program through entry into service.
Good "flying qualities" are fundamental to the elimination of adverse APC. The starting point for military aircraft is compliance with the requirements in MIL-STD-1797A and Draft MIL-STD-1797A Update.70,71 Compliance lessens APC tendencies in classical fixed-wing aircraft with modest stability augmentation systems and conventional fully-powered surface actuating systems. Rotorcraft that meet the requirements of ADS-33D68 are
also likely to be more resistant to APC events. However, these specifications, like the criteria upon which they are based, do not adequately address the susceptibility of aircraft to Category II and III PIOs and to non-oscillatory APCs. These requirements should be supplemented early in the design process by appropriate criteria and metrics selected and tailored, as necessary, to guide development teams in assessing the flying qualities and susceptibility of new aircraft to adverse APC. The APC criteria should emphasize highly demanding, closed-loop operations of the PVS, as well as precision maneuvering characteristics. The criteria should be viewed as a means of alerting the analysis and design teams to features that can increase the risk of APC. Current design criteria cannot guarantee that a given design will be free of adverse APC characteristics in flight. Appropriate combinations of available APC criteria are generally useful for assessing the susceptibility of aircraft designs to most types of linear, oscillatory APC events (i.e., Category I PIOs). Available criteria do not effectively address more complex types of APC events—Category II and III PIOs and non-oscillatory APC events. Research on APC design assessment criteria should focus on these less understood types of APC events; a coordinated approach that combines experiments with the development of new analysis approaches is essential.
Simulation and Flight Tests
Ground and in-flight simulators and pilots who are sensitive to APC tendencies can contribute to the development of a FCS with satisfactory APC characteristics. The potential of simulators to reproduce APC events that have been encountered in flight has been repeatedly demonstrated. However, the continuing occurrence of unexpected APC events in flight also illustrates the limited effectiveness of current simulation technologies and procedures for predicting APC events. Existing simulation and analysis tools should be refined to be more specific, selective, and accurate predictors. A high priority should be placed on research to develop predictive simulation protocols and tasks and to validate simulation test results with flight tests.
Fixed-base simulators may not always reveal the existence of adverse APC tendencies because of (1) the lack of acceleration cues; (2) less-than-satisfactory visual systems; (3) inadequate simulation of major FCS details, especially inceptors and FCS characteristics that come into play when PVS operations are at or near transitions or other conditions that define margins; and (4) the difficulty of instilling stress and a sense of urgency in the pilot. Moving-base simulators may be more effective than fixed-base simulators in some parts of the flight envelope, although they too can have the deficiencies listed above, as well as the oddities of motion washout and other artifacts. The committee believes that a high-quality visual display is more effective than a
moving base because most simulations involve instrument-rated pilots who are trained to rely upon visual rather than acceleration cues.
In-flight simulation solves many of the problems inherent in ground simulation if the effective aircraft dynamics, including inceptors, are well simulated. In-flight simulation can be especially valuable for increasing the APC awareness of test and operational pilots and flight test engineers and for demonstrating and conducting research on cliff-like APC phenomena (Category II and III PIOs and non-oscillatory APCs). Highly focused flight-test evaluations of prototypes or pre-certification aircraft can be particularly helpful for identifying flight situations that might be susceptible to APC, as well as for providing the final measures of performance.
Throughout the simulation and flight test process, pilots must be assigned appropriate tasks (see Chapter 4) in order to evaluate APC characteristics effectively. Because APC events are commonly associated with highly demanding, precisely controlled aircraft movements, simulation and flight tests used for assessing APC tendencies should include such tasks as aggressive acquisition maneuvers, aggressive tracking maneuvers, mode transitions, formation flying and aerial refueling, approach and landing, and special tracking tasks.
It is important that a variety of repeatable tasks be included to ensure that APC assessments are comprehensive and verifiable. In addition, many pilots should be involved in simulation and flight tests to ensure that the aircraft will accommodate a wide range of piloting skills; two or three test pilots are not enough to conduct a thorough evaluation and examination if APC characteristics are marginally acceptable. An aggressive search for APC tendencies is especially important in flight regimes where cliff-like phenomena are most likely to appear.
Recommendation. A disciplined and structured approach should be taken in the design, development, testing, and certification stages to maximize the effectiveness of existing techniques for mitigating the risk of adverse APC tendencies and for expediting the incorporation of new techniques as they become available. This is especially important in areas where effective procedures and standards do not currently exist (e.g., FAA certification standards).
Interim Prescription For Avoiding Severe Aircraft-Pilot Coupling Events
This report stresses the need for enhanced awareness of APC phenomena and an orderly and structured design and development process to address this problem. Although no definitive criteria are applicable to all types of APC
events, the technical guidelines that appear below can confer immunity to most severe APC events. The committee recognizes that readers concerned with specifics may find the following discussion of processes and criteria too general, even as other readers who are unfamiliar with APC phenomenology may find the details of some technical descriptions difficult to understand.
Reduce Category I Pilot-Induced Oscillation Tendencies
Implications for Design of the Effective Aircraft Dynamics
Reduce time lags in the high-frequency effective aircraft dynamics. To reduce tendencies for attitude-dominant PIOs, increase the frequency range over which a pilot hypothetically operating in a pure-gain (proportional control) mode can exert closed-loop control on aircraft attitude. Counter possible interactions between the pilot and higher-frequency modes of the effective aircraft dynamics.
Suitable Metrics and Criteria
Ensure that inceptor characteristics, flexible modes of the aircraft structure, and other elements of a PVS that incorporates a pure-gain pilot do not create high frequency closed-loop resonances. Three criteria (i.e., the Gain/Phase Template Plus ω180/Average Phase Rate criterion, the Dropback criterion, and the Aircraft-Bandwidth/Phase Delay criterion) can provide useful warnings and design guidance.
Minimize Category II and III Pilot-Induced Oscillation Tendencies
Implications for Design of the Effective Aircraft Dynamics
Provide seamless transitions when the FCS switches between control modes or control laws. Minimize transitions that create large increases in the phase lag or gain that the FCS applies to the pilot's commands, especially simultaneous increases in both.
Suitable Metrics and Criteria
Develop metrics and criteria for predicting Category II and III PIO tendencies. (Currently, such criteria do not exist.) Reduce the effects of phase
lag introduced by rate limiting by providing liberal rate limits and minimizing the need for large pilot commands during critical closed-loop tasks. Command-gain changes and pre- to post-transition dynamic shifts of no more than about 3 dB (50 percent) are tentative lower limits for tasks that require the pilot to exert tight closed-loop control.
Examine the Possibility of Non-Oscillatory Aircraft-Pilot Coupling Events
In searching for unexpected non-oscillatory APC events, consider special maneuvers, pilot commands, and FCS inputs that may effectively increase the time lag between the pilot's command and its reflection at the control surface.
Conduct Assessments and Evaluations Using Simulators
Implications for Design
Provide simulator characteristics that are valid reflections of effective aircraft dynamics, especially for high PVS frequencies and conditions where FCS operations are nonlinear. Extensively examine situations that analysis has indicated are marginal with respect to the occurrence of Category I APC events. Conduct a specialized and detailed search for potentially critical Category II and III (cliff-like) situations using an impartial team of experienced FCS engineers. Include circumstances that may require large pilot inputs, high pilot gain, or FCS shifts between modes and/or control laws.
Implications for Test Execution
Use test input sequences that put maximal stress on the PVS. Include periods of active, freelance pilot operations to search for potential limiting conditions (see Table 4-2). Also include a broad spectrum of test pilots and operational pilots. Examine maneuvers and command sequences that may effectively increase the time lag between the pilot's command and the control surface effector's reflection of this command.
Conduct Flight Evaluations
Use flight evaluations, which are closely related to simulation tests, to build on the results of simulation. In particular, use test input sequences that stress the PVS to extremes and include a spectrum of pilots. Conduct tests of
situations where PVS performance was previously determined or suspected to be marginal, as well as conditions that have no parallel in simulation (e.g., situations that involve very high frequency modes or acceleration-sensitive phenomena). Devote an investigatory phase, with appropriate safety measures, to an active and aggressive search by pilots for potential, cliff-like PIO conditions, such as conditions involving rate or position limits. Include carefree freelance operations that provide test pilots with "open time" to experiment freely.
The approaches used to address APC risk in the U.S. and international civil and military aviation communities are not consistent. Some organizations rely heavily on the analysis of new designs in accordance with formal APC criteria. Others rely primarily on empirical methods and rules of thumb based on experience with prior aircraft. The committee did not find any approach that consistently produces aircraft free of adverse APC characteristics. APC events thus remain a threat, and the potential for tragedy will persist until the goal of reducing APC risk is aggressively pursued.
Manufacturers of civil and military aircraft often consider the approaches they use to reduce the risk of adverse APC as a component of their proprietary design and manufacturing process. In addition, the APC characteristics of current aircraft are often treated as proprietary or classified performance data. These attitudes tend to inhibit the exchange of APC-related information and interfere with cooperative efforts to reduce the risk. Nevertheless, the committee believes that, in the interest of aviation safety, the free exchange of APC-related information on design and manufacturing processes and on aircraft performance characteristics should be encouraged throughout the military and civil aviation communities, nationally and internationally. This report, which contains a great deal of data, information, and procedures that would normally be considered proprietary, is a step in this direction.